CNFE flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Order of volatility

RFC 3227 ranking of evidence by how quickly it disappears: CPU state, RAM, network connections, disk, logs, archival media. Collect the most perishable data first.

Chain of custody

Chronological record of who handled evidence, when, where, and why, with signatures and hashes at each transfer, proving the evidence was not altered or substituted.

Preservation letter 18 USC 2703(f)

A request to a service provider to retain stored subscriber records and content for 90 days pending legal process, extendable once for another 90 days.

Daubert admissibility factors

Judicial test for expert evidence: testability, peer review, known error rate, standards and controls, and general acceptance in the relevant field.

EtherType field values

Two-byte Ethernet II field identifying the payload protocol: 0x0800 IPv4, 0x0806 ARP, 0x86DD IPv6, 0x8100 VLAN tag. Read it to decode the next header correctly.

TCP flag byte values

Bit values in the TCP flags field: FIN 0x01, SYN 0x02, RST 0x04, PSH 0x08, ACK 0x10, URG 0x20, ECE 0x40, CWR 0x80. Used to filter scan and teardown patterns.

IP fragmentation fields

Identification, Flags (DF, MF), and Fragment Offset in 8-byte units. Overlapping fragments with conflicting payloads are a classic IDS evasion technique.

TLS SNI visibility

Server Name Indication appears in cleartext in the ClientHello, revealing the requested hostname in TLS 1.2 captures and usually in TLS 1.3 unless Encrypted Client Hello is used.

DHCP DORA sequence

Four-message exchange: Discover broadcast, Offer from server, Request broadcast, Acknowledge. Multiple Offers to one Discover suggest a rogue DHCP server on the segment.

Capture storage sizing formula

Bytes equals packets per second times average frame size times seconds. A 10,000 pps stream of 500-byte frames for one hour yields about 18 GB.

SPAN port versus TAP

A mirror port can drop frames under oversubscription and may rewrite the FCS; a network TAP preserves line-rate fidelity and is preferred for evidentiary captures.

Snaplen and truncation risk

The number of bytes captured per frame. A reduced snaplen truncates payload and destroys content evidence; tcpdump -s 0 captures the full frame.

Capture integrity hashing

Compute SHA-256 of the capture file at acquisition and again before analysis; matching values prove the file was not altered between collection and examination.

Promiscuous versus monitor mode

Promiscuous mode makes a wired NIC accept unicast frames not addressed to it; monitor mode is required for 802.11 management and control frames.

IDS rule anatomy

Action, protocol, source and destination address and port, then options such as msg, content, flow, and sid. The sid uniquely identifies the signature and rev tracks revisions.

flowbits stateful matching

A rule option that sets and tests flags across packets in a session, allowing detection of multi-stage activity such as a request followed by a specific response.

Windows Event ID 4624 logon types

Records successful logons; type 2 is interactive, 3 is network, 10 is Remote Desktop. Logon type distinguishes local access from lateral movement.

Beaconing jitter analysis

Measuring variance in connection intervals to a single destination. Low variance with consistent payload size indicates automated command-and-control check-in rather than human browsing.

Syslog PRI calculation

Priority value equals facility multiplied by eight plus severity. Severity ranges from 0 Emergency to 7 Debug, allowing filtering of high-value events.

JA3 fingerprint construction

MD5 hash of TLS ClientHello version, cipher suites, extensions, elliptic curves, and EC point formats joined in order, identifying client malware families independent of IP.

DGA detection signals

High NXDOMAIN ratio, high entropy in the second-level label, uniform label lengths, and bursts of failed lookups followed by one successful resolution.

Domain fronting indicator

The TLS SNI names a CDN front domain while the HTTP Host header names a different origin, routing traffic through shared infrastructure to evade blocking.

DNS tunneling indicators

Long encoded subdomain labels, TXT or NULL record abuse, high query volume to one authoritative server, and unusually large responses relative to normal lookups.

Sandbox egress caveat

Sandbox traffic is often proxied or simulated, so observed destination IPs may belong to the sandbox infrastructure rather than the real command-and-control server.

NIST 800-61 phases

Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity. Containment choice weighs scope, cost, and attacker awareness.

Containment strategy selection

Choose among host isolation, perimeter ACL block, DNS sinkhole, or segment disconnection based on disruption cost and whether the attacker would detect and react.

Scope enumeration pivot

Identify every host that communicated with the known indicator during the exposure window, then check for internal spread via SMB, RDP, or WMI.

Timeline normalization

Convert all source timestamps to UTC, record per-source clock skew, and order events by event time and ingestion time to expose delayed or missing logging.

Reproducible finding citation

Each finding names the capture file, frame number, UTC timestamp, and exact filter used, so an independent examiner can regenerate the same result.

Expert witness gatekeeping

The court assesses qualification, methodological reliability, helpfulness to the trier of fact, and fit between the testimony and the facts of the case.

Capture versus display filter syntax

Capture filters use BPF syntax such as host and port; display filters use Wireshark syntax such as ip.addr and tcp.port. They are not interchangeable.

Zeek core log set

conn.log, dns.log, http.log, ssl.log, and files.log, each carrying a uid and ts field that allow cross-log joins during an investigation.